36C25525Q0387 RFQ Pyxis Mestation Upgrade - CO.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

589-25-1-5622-0549

36C25525Q0387 06-03-2025

Erika Kobulnicky/Erika.Kobulnicky@va.gov 913-946-1991 06-09-2025

7:00AM CDT

36C255

Department of Veterans Affairs Network Contracting Office (NCO) 15 3450 S 4th Street Trafficway Leavenworth KS 66048

X 100

X

513210

$34 Million

N/A

X

Harry S. Truman Memorial VAMC 800 Hospital Drive Columbia MO 65201-5275

36C255

Department of Veterans Affairs Network Contracting Office (NCO) 15 3450 S 4th Street Trafficway

Leavenworth KS 66048

36C255

Department of Veterans Affairs Financial Services Center http://www.fsc.va.gov/einvoice.asp

Austin TX

877-353-9791 512-460-5429

See CONTINUATION Page

Profile Upgrade for five (5) Current Pyxis Medstations at the Columbia VAMC.

Contractor shall provide software upgrade to Pyxis pharmacy medication dispensing equipment in accordance with Statement of Work (SOW).

Contractor shall provide an authorized distributor letter for Pyxis from Becton Dickinson/CareFusion Solutions.

This is 100% set aside for SDVOSBs.

There is not a class waiver issued for the selected NAICS.

Questions due June 6, 2025 by 7:00AM CST.

Evaluation Criteria: Lowest Price Technically Acceptable

See CONTINUATION Page

X X

X one(1)

Lisa Buchanan Contracting Officer

36C25525Q0387

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 STATEMENT OF WORK

B.3 PRICE/COST SCHEDULE

ITEM INFORMATION

B.4 DELIVERY SCHEDULE

SECTION C - CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 VAAR 852.201-70 CONTRACTING OFFICER'S REPRESENTATIVE (DEC 2022)

C.3 VAAR 852.203-70 COMMERCIAL ADVERTISING (MAY 2018)

C.4 VAAR 852.211-76 LIQUIDATED DAMAGES – REIMBURSEMENT FOR DATA

BREACH COSTS (FEB 2023) ALTERNATE I (FEB 2023)

C.5 VAAR 852.212-71 GRAY MARKET AND COUNTERFEIT ITEMS (FEB 2023)

C.6 VAAR 852.219-73 VA NOTICE OF TOTAL SET-ASIDE FOR CERTIFIED

SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESSES (JAN 2023)

(DEVIATION)

C.7 VAAR 852.219-75 VA NOTICE OF LIMITATIONS ON SUBCONTRACTING—

CERTIFICATE OF COMPLIANCE FOR SERVICES AND CONSTRUCTION (JAN 2023)

(DEVIATION)

C.8 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV

2018)

C.9 VAAR 852.239-70 SECURITY REQUIREMENTS FOR INFORMATION

TECHNOLOGY RESOURCES (FEB 2023)

C.10 VAAR 852.239-73 INFORMATION SYSTEM HOSTING, OPERATION,

MAINTENANCE, OR USE (FEB 2023)

C.11 VAAR 852.239-74 SECURITY CONTROLS COMPLIANCE TESTING (FEB 2023)

C.12 VAAR 852.239-76 INFORMATION AND COMMUNICATION TECHNOLOGY

ACCESSIBILITY (FEB 2023)

C.13 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020) ..24

C.14 VAAR 852.246-71 REJECTED GOODS (OCT 2018)

C.15 FAR 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO

IMPLEMENT STATUTES OR EXECUTIVE ORDERS – COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES(JAN 2025)(DEVIATION FEB 2025)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

E.3 VAAR 852.239-71 INFORMATION SYSTEM SECURITY PLAN AND

ACCREDITATION (FEB 2023)

E.4 VAAR 852.239-75 INFORMATION AND COMMUNICATION TECHNOLOGY

ACCESSIBILITY NOTICE (FEB 2023)

E.5 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (MAY 2024) (DEVIATION

FEB 2025)

E.6 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (NOV 2021)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C255 Lisa Buchanan/ Lisa.Buchanan1@va.gov

Contracting Specialist 36C255 Erika Kobulnicky/ Erika.Kobulnicky@va.gov

Department of Veterans Affairs

Network Contracting Office (NCO) 15

3450 S 4th Street Trafficway

Leavenworth KS 66048

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly []

b. Semi-Annually []

c. Other [X] Upon delivery, installation and acceptance

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Department of Veterans Affairs

Financial Services Center http://www.fsc.va.gov/einvoice.asp

ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

B.2 STATEMENT OF WORK

Profile upgrades for current Pyxis Medstations

GENERAL INFORMATION

1.0 Scope of Work: The Contractor shall deliver all items listed in section 3.0 All items must meet all salient characteristics defined in section 3.0

2.0 Background: BD Pyxis is a sole source contract that was written VISN wide. Adding profiling ability to these five existing units would match the rest of the machines (from same original contract) that are already profiled. To be clearer, the upgrades would occur through software upgrade on same equipment. The software upgrade is proprietary to this particular brand of equipment. Profiling a Pyxis machine enhances medication safety by not allowing removal of medication without having a prescription order verified by a pharmacist prior to removal for administration by a nurse or provider.

CONTRACTOR REQUIREMENTS

3.0 Technical Requirements/Tasks: Equipment below includes shipping, installation, and a one‐year warranty.

4.0 Government Furnished: The Truman VA Pharmacy Department will provide government‐ furnished support, data, property or facilities. The Truman VA has the responsibility for reviewing and approving reports and final products generated under the contract.

5.0 Deliverables / Schedule:

5.1 Delivery and Install Timeframe: Immediate upon award NLT July 30, 2025

5.2 The Contractor shall contact the On‐Site Point of Contact to schedule a pre‐delivery meeting to be conducted approximately 14 days prior to the initial award delivery date for verification of delivery dates.

5.3 The Contractor may be required to adjust the delivery date from the date specified in the contract award document.

5.4 A government‐requested delivery delay up to 90 days after the delivery date specified in the contract award shall be at no additional cost to the government.

5.5 Delivery Location: Contractor shall deliver designated equipment to the respective operational sites:

Columbia VAMC Attn: Pharmacy

800 Hospital Drive

Columbia, MO 65201‐5275

6.0 Travel: The Contractor will be responsible for the cost for travel requirements, locations involved, number of trips (if known), and duration of anticipated travel.

7.0 Contractor’s Key Personnel: The Truman VA hospital Chief of Pharmacy, Associate Chief of Operations and Contracting Officer Representative are considered key to successful performance of the contract and the information required to support key personnel qualifications.

8.0 Security Requirements: Security background checks are not required.

9.0 Data Rights: If data is to be produced, furnished, acquired, or used in meeting contract requirements, the respective rights and obligations will become property of the government regarding the use, production, and disclosure of that data.

10.0 Section 508 – Electronic and Information Technology Standards: When information technology is to be acquired, the contractor will obey the government Section 508 requirements.

11.0 Training

11.1 VA HIPAA and Rules of Behavior Training is required when contractors have access to PII/PHI.

11.2 Contractor shall complete all Privacy and Security training in accordance with VA guidance.

B.3 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

5.00 JB __________________ __________________

Profile Upgrade for Pyxis

Contract Period: Base POP Begin: 06-20-2025 POP End: 07-30-2025

MANUFACTURER PART NUMBER (MPN): 135291-01

GRAND TOTAL __________________

B.4 DELIVERY SCHEDULE

ITEM

NUMBER SHIPPING INFORMATION QUANTITY

DELIVERY

DATE

0001 SHIP TO: Harry S. Truman Veterans' Hospital 800 Hospital Drive Warehouse Columbia, MO 65201 5275

USA

5.00 07/30/2025

MARK FOR: Carlton Foust 573-814-6673 Carlton.Foust@va.gov

FOB: DESTINATION

SECTION C - CONTRACT CLAUSES

FAR

Number

Title Date

52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES

NOV 2023

ADDENDUM to FAR 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL

PRODUCTS AND COMMERCIAL SERVICES

Clauses that are incorporated by reference (by Citation Number, Title, and Date), have the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available.

The following clauses are incorporated into 52.212-4 as an addendum to this contract:

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

https://www.acquisition.gov/browse/index/far https://www.va.gov/oal/library/vaar/

(End of Clause)

Number

Title Date

52.204-13 SYSTEM FOR AWARD MANAGEMENT MAINTENANCE OCT 2018

52.204-18 COMMERCIAL AND GOVERNMENT ENTITY CODE

MAINTENANCE

AUG 2020

52.223-5 POLLUTION PREVENTION AND RIGHT-TO-KNOW

INFORMATION

MAY 2024

52.227-16 ADDITIONAL DATA REQUIREMENTS JUN 1987

C.2 VAAR 852.201-70 CONTRACTING OFFICER'S REPRESENTATIVE (DEC

2022) The Contracting Officer reserves the right to designate representatives to act for him/her in furnishing technical guidance and advice or generally monitor the work to be performed under this contract. Such designation will be in writing and will define the scope and limitation of the designee’s authority. A copy of the designation letter shall be furnished to the Contractor.

(End of Clause)

C.3 VAAR 852.203-70 COMMERCIAL ADVERTISING (MAY 2018)

The Contractor shall not make reference in its commercial advertising to Department of Veterans Affairs contracts in a manner that states or implies the Department of Veterans Affairs approves or endorses the Contractor’s products or services or considers the Contractor’s products or services superior to other products or services.

(End of Clause)

C.4 VAAR 852.211-76 LIQUIDATED DAMAGES – REIMBURSEMENT FOR

DATA BREACH COSTS (FEB 2023) ALTERNATE I (FEB 2023)

(a) Definition. As used in this clause, ‘‘contract’’ means any contract, agreement, order or other instrument and encompasses the definition set forth in FAR 2.101.

(b) Non-disclosure requirements. As a condition of performance under a contract, order, agreement, or other instrument that requires access to sensitive personal information as defined in VAAR 802.101, the following is expressly required—

(1) The Contractor, subcontractor, their employees or business associates shall not, directly or through an affiliate or employee of the Contractor, subcontractor, or business associate, disclose sensitive personal information to any other person unless the disclosure is lawful and is expressly permitted under the contract; and

(2) The Contractor, subcontractor, their employees or business associates shall immediately notify the Contracting Officer and the Contracting Officer’s Representative (COR) of any security incident that occurs involving sensitive personal information.

(c) Liquidated damages. If the Contractor or any of its agents fails to protect VA sensitive personal information or otherwise engages in conduct which results in a data breach, the Contractor shall, in place of actual damages, pay to the Government liquidated damages of [$37.50] per affected individual in order to cover costs related to the notification, data breach analysis and credit monitoring. In the event the Contractor provides payment of actual damages in an amount determined to be adequate by the Contracting Officer, the Contracting Officer may forgo collection of liquidated damages.

(d) Purpose of liquidated damages. Based on the results from VA’s determination that there was a data breach caused by Contractor’s or any of its agents’ failure to protect or otherwise engaging in conduct to cause a data breach of VA sensitive personal information, and as directed by the Contracting Officer, the Contractor shall be responsible for paying to the VA liquidated damages in the amount of [$37.50] per affected individual to cover the cost of the following:

(1) Notification related costs.

(2) Credit monitoring reports.

(3) Data breach analysis and impact.

(4) Fraud alerts.

(5) Identity theft insurance.

(e) Relationship to termination clause, if applicable. If the Government terminates this contract in whole or in part under the Termination for cause paragraph, FAR 52.212–4(m), Contract

Terms and Conditions—Commercial Products and Commercial Services, the Contractor is liable for damages accruing until the Government reasonably obtains delivery or performance of similar supplies or services. These damages are in addition to costs of repurchase as may be required under the Termination clause.

(End of Clause)

C.5 VAAR 852.212-71 GRAY MARKET AND COUNTERFEIT ITEMS (FEB

2023)

(a) No used, refurbished, or remanufactured supplies or equipment/parts shall be provided.

This procurement is for new Original Equipment Manufacturer (OEM) items only. No gray market items shall be provided. Gray market items are OEM goods intentionally or unintentionally sold outside an authorized sales territory or sold by non-authorized dealers in an authorized sales territory.

(b) No counterfeit supplies or equipment/ parts shall be provided. Counterfeit items include unlawful or unauthorized reproductions, substitutions, or alterations that have been mismarked, misidentified, or otherwise misrepresented to be an authentic, unmodified item from the original manufacturer, or a source with the express written authority of the original manufacturer or current design activity, including an authorized aftermarket manufacturer. Unlawful or unauthorized substitutions include used items represented as new, or the false identification of grade, serial number, lot number, date code, or performance characteristics.

(c) Vendor shall be an OEM, authorized dealer, authorized distributor, or authorized reseller for the proposed equipment/system, verified by an authorization letter or other documents from the OEM. All software licensing, warranty and service associated with the equipment/system shall be in accordance with the OEM terms and conditions.

(End of Clause)

C.6 VAAR 852.219-73 VA NOTICE OF TOTAL SET-ASIDE FOR CERTIFIED

SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESSES (JAN 2023)

(DEVIATION)

(a) Definition. for the Department of Veterans Affairs, ‘‘Service-disabled Veteran-owned small business concern or SDVOSB’’:

(1) Means a small business concern—

(i) Not less than 51 percent of which is owned by one or more service-disabled Veterans or, in the case of any publicly owned business, not less than 51 percent of the stock of which is owned by one or more service-disabled Veterans or eligible surviving spouses (see VAAR 802.201, Surviving Spouse definition);

(ii) The management and daily business operations of which are controlled by one or more service-disabled Veterans (or eligible surviving spouses) or, in the case of a service-disabled Veteran with permanent and severe disability, the spouse or permanent caregiver of such Veteran;

(iii) The business meets Federal small business size standards for the applicable North American Industry Classification System (NAICS) code identified in the solicitation document;

(iv) The business has been certified for ownership and control pursuant to 38 U.S.C. 8127, 13 CFR 128, and is listed as certified in the SBA certification database at https://veterans.certify.sba.gov/; and

(v) The business agrees to comply with VAAR subpart 819.70 and Small Business Administration (SBA) regulations regarding small business size, government contracting, and the Veteran Small Business Certification Program at 13 CFR parts 121, 125, and 128.

(2) The term ‘‘Service-disabled Veteran’’ means a Veteran, as defined in 38 U.S.C. 101(2), with a disability that is service-connected, as defined in 38 U.S.C. 101(16).

(3) The term ‘‘small business concern’’ has the meaning given that term under section 3 of the Small Business Act (15 U.S.C. 632).

(4) The term ‘‘small business concern owned and controlled by Veterans with service-connected disabilities’’ has the meaning given the term ‘‘small business concern owned and controlled by service-disabled veterans’’ under section 3(q)(2) of the Small Business Act (15 U.S.C. 632(q)(2)).

(5) The term “SDVOSB participant” or certified SDVOSB means a small business that has been certified in the SBA Veteran Small Business Certification Program and listed in the SBA certification database (see 13 CFR 128.102).

(b) General. In order for a concern to submit an offer and be eligible for the award of an SDVOSB set-aside or sole source contract, the concern must qualify as a small business concern under the size standard corresponding to the NAICS code assigned to the contract and be listed as an SDVOSB participant in the SBA certification database as set forth in 13 CFR 128.

(1) Offers received from entities that are not certified SDVOSBs and listed in the SBA certification database at the time of offer shall not be considered.

(2) Any award resulting from this solicitation shall be made to a certified SDVOSB listed in the SBA certification database who is eligible at the time of submission of offer(s) and at the time of award.

(3) The requirements in this clause apply to any contract, order or subcontract where the firm receives a benefit or preference from its designation as an SDVOSB, including set-asides, sole source awards, and evaluation preferences.

(c) Representation. Pursuant to 38 U.S.C. 8127(e), only certified SDVOSBs listed in the SBA certification database are considered eligible to receive award of a resulting contract. By submitting an offer, the prospective contractor represents that it is an eligible and certified SDVOSB as defined in this clause, 13 CFR 121, 125, and 128, and VAAR subpart 819.70.

(d) Agreement/LOS certification. When awarded a contract action, including orders under multipleaward contracts, an SDVOSB agrees that in the performance of the contract, the https://veterans.certify.sba.gov/

SDVOSB shall comply with requirements in VAAR subpart 819.70 and SBA regulations on small business size, and government contracting programs at 13 CFR part 121 and part 125, including the non-manufacturer rule and limitations on subcontracting (LOS) requirements in 13 CFR 121.406(b) and 13 CFR 125.6. For the purpose of limitations on subcontracting, only certified SDVOSBs listed in the SBA certification database (including independent contractors) shall be considered eligible and/or ‘‘similarly situated’’ (i.e., a firm that has the same small business program status as the prime contractor). An otherwise eligible firm further agrees to comply with the required LOS certification requirements in this solicitation (see 852.219–75 or 852.219–76 as applicable). These requirements are summarized as follows:

(1) Services. In the case of a contract for services (except construction), the SDVOSB prime contractor will not pay more than 50% of the amount paid by the government to the prime for contract performance to firms that are not certified SDVOSBs listed in the SBA certification database (excluding direct costs to the extent they are not the principal purpose of the acquisition and the SDVOSB/ VOSB does not provide the service, such as airline travel, cloud computing services, or mass media purchases). When a contract includes both services and supplies, the 50 percent limitation shall apply only to the service portion of the contract.

(2) Supplies/products.

(i) In the case of a contract for supplies or products (other than from a non-manufacturer of such supplies), the SDVOSB prime contractor will not pay more than 50% of the amount paid by the government to the prime for contract performance, excluding the cost of materials, to firms that are not certified SDVOSBs listed in the SBA certification database. When a contract includes both supply and services, the 50 percent limitation shall apply only to the supply portion of the contract.

(ii) In the case of a contract for supplies from a non-manufacturer, the SDVOSB prime contractor will supply the product of a domestic small business manufacturer or processor, unless a waiver as described in 13 CFR 121.406(b)(5) has been granted. Refer to 13 CFR 125.6(a)(2)(ii) for guidance pertaining to multiple item procurements.

(3) General construction. In the case of a contract for general construction, the SDVOSB prime contractor will not pay more than 85% of the amount paid by the government to the prime for contract performance, excluding the cost of materials, to firms that are not certified SDVOSBs listed in the SBA certification database.

(4) Special trade construction contractors. In the case of a contract for special trade contractors, no more than 75% of the amount paid by the government to the prime for contract performance, excluding the cost of materials, may be paid to firms that are not certified SDVOSBs listed in the SBA certification database.

(5) Subcontracting. An SDVOSB subcontractor must meet the NAICS size standard assigned by the prime contractor and be certified and listed in the SBA certification database to count as similarly situated. Any work that a first tier SDVOSB subcontractor further subcontracts will count towards the percent of subcontract amount that cannot be exceeded. For supply or construction contracts, the cost of materials is excluded and not considered to be subcontracted. When a contract includes both services and supplies, the 50 percent limitation shall apply only to the portion of the contract with the preponderance of the expenditure upon which the assigned NAICS is based. For information and more specific requirements, refer to 13

CFR 125.6.

(e) Required limitations on subcontracting compliance measurement period. An SDVOSB shall comply with the limitations on subcontracting as follows:

[X] By the end of the base term of the contract or order, and then by the end of each subsequent option period; or

[] By the end of the performance period for each order issued under the contract.

(f) Joint ventures. A joint venture may be considered eligible as an SDVOSB if the joint venture complies with the requirements in 13 CFR 128.402 and the managing joint venture partner makes the representations under paragraph (c) of this clause. A joint venture agrees that, in the performance of the contract, the applicable percentage specified in paragraph (d) of this clause will be performed by the aggregate of the joint venture participants.

(g) Precedence. The VA Veterans First Contracting Program, as defined in VAAR 802.101, subpart 819.70, and this clause, takes precedence over any inconsistencies between the requirements of the SBA Veteran Small Business Certification Program and the VA Veterans First Contracting Program.

(h) Misrepresentation. Pursuant to 38 U.S.C. 8127(g), any business concern, including all its principals, that is determined by VA to have willfully and intentionally misrepresented a company’s SDVOSB status is subject to debarment from contracting with the Department for a period of not less than five years (see VAAR 809.406–2 Causes for Debarment).

(End of Clause)

C.7 VAAR 852.219-75 VA NOTICE OF LIMITATIONS ON

SUBCONTRACTING—CERTIFICATE OF COMPLIANCE FOR SERVICES AND

CONSTRUCTION (JAN 2023) (DEVIATION)

(a) Pursuant to 38 U.S.C. 8127(l)(2), the offeror certifies that—

(1) If awarded a contract (see FAR 2.101 definition), it will comply with the limitations on subcontracting requirement as provided in the solicitation and the resultant contract, as follows:

(i) [X] Services. In the case of a contract for services (except construction), the contractor will not pay more than 50% of the amount paid by the government to it to firms that are not certified SDVOSBs listed in the SBA certification database as set forth in 852.219–73 or certified VOSBs listed in the SBA certification database as set forth in 852.219–74. Any work that a similarly situated certified SDVOSB/VOSB subcontractor further subcontracts will count towards the 50% subcontract amount that cannot be exceeded. Other direct costs may be excluded to the extent they are not the principal purpose of the acquisition and small business concerns do not provide the service as set forth in 13 CFR 125.6.

(ii) [] General construction. In the case of a contract for general construction, the contractor will not pay more than 85% of the amount paid by the government to it to firms that are not certified SDVOSBs listed in the SBA certification database as set forth in 852.219–73 or certified VOSBs listed in the SBA certification database as set forth in 852.219–74. Any work that a similarly situated certified SDVOSB/VOSB subcontractor further subcontracts will count towards the 85% subcontract amount that cannot be exceeded. Cost of materials are excluded and not considered to be subcontracted.

(iii) [] Special trade construction contractors. In the case of a contract for special trade contractors, the contractor will not pay more than 75% of the amount paid by the government to it to firms that are not certified SDVOSBs listed in the SBA certification database as set forth in 852.219–73 or certified VOSBs listed in the SBA certification database as set forth in 852.219–

74. Any work that a similarly situated certified SDVOSB/VOSB subcontractor further subcontracts will count towards the 75% subcontract amount that cannot be exceeded. Cost of materials are excluded and not considered to be subcontracted.

(2) The offeror acknowledges that this certification concerns a matter within the jurisdiction of an Agency of the United States. The offeror further acknowledges that this certification is subject to Title 18, United States Code, Section 1001, and, as such, a false, fictitious, or fraudulent certification may render the offeror subject to criminal, civil, or administrative penalties, including prosecution.

(3) If VA determines that an SDVOSB/ VOSB awarded a contract pursuant to 38 U.S.C. 8127 did not act in good faith, such SDVOSB/VOSB shall be subject to any or all of the following:

(i) Referral to the VA Suspension and Debarment Committee;

(ii) A fine under section 16(g)(1) of the Small Business Act (15 U.S.C. 645(g)(1)); and

(iii) Prosecution for violating 18 U.S.C. 1001.

(b) The offeror represents and understands that by submission of its offer and award of a contract it may be required to provide copies of documents or records to VA that VA may review to determine whether the offeror complied with the limitations on subcontracting requirement specified in the contract. Contracting officers may, at their discretion, require the contractor to demonstrate its compliance with the limitations on subcontracting at any time during performance and upon completion of a contract if the information regarding such compliance is not already available to the contracting officer. Evidence of compliance includes, but is not limited to, invoices, copies of subcontracts, or a list of the value of tasks performed.

(c) The offeror further agrees to cooperate fully and make available any documents or records as may be required to enable VA to determine compliance with the limitations on subcontracting requirement. The offeror understands that failure to provide documents as requested by VA may result in remedial action as the Government deems appropriate.

(d) Offeror completed certification/fill-in required. The formal certification must be completed, signed and returned with the offeror’s bid, quotation, or proposal. The Government will not consider offers for award from offerors that do not provide the certification, and all such responses will be deemed ineligible for evaluation and award.

Certification

I hereby certify that if awarded the contract, [insert name of offeror] will comply with the limitations on subcontracting specified in this clause and in the resultant contract. I further certify that I am authorized to execute this certification on behalf of [insert name of offeror].

Printed Name of Signee: ___________

Printed Title of Signee: _____________

Signature: ____________

Date: ______________

Company Name and Address: _______________

(End of Clause)

C.8 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT

REQUESTS (NOV 2018)

(a) Definitions. As used in this clause—

(1) Contract financing payment has the meaning given in FAR 32.001;

(2) Designated agency office means the office designated by the purchase order, agreement, or contract to first receive and review invoices. This office can be contractually designated as the receiving entity. This office may be different from the office issuing the payment;

(3) Electronic form means an automated system transmitting information electronically according to the accepted electronic data transmission methods and formats identified in paragraph (c) of this clause. Facsimile, email, and scanned documents are not acceptable electronic forms for submission of payment requests;

(4) Invoice payment has the meaning given in FAR 32.001; and

(5) Payment request means any request for contract financing payment or invoice payment submitted by the contractor under this contract.

(b) Electronic payment requests. Except as provided in paragraph (e) of this clause, the contractor shall submit payment requests in electronic form. Purchases paid with a Government-wide commercial purchase card are considered to be an electronic transaction for purposes of this rule, and therefore no additional electronic invoice submission is required.

(c) Data transmission. A contractor must ensure that the data transmission method and format are through one of the following:

(1) VA’s Electronic Invoice Presentment and Payment System at the current website address provided in the contract.

(2) Any system that conforms to the X12 electronic data interchange (EDI) formats established by the Accredited Standards Center (ASC) and chartered by the American National Standards Institute (ANSI).

(d) Invoice requirements. Invoices shall comply with FAR 32.905.

(e) Exceptions. If, based on one of the circumstances in this paragraph (e), the Contracting Officer directs that payment requests be made by mail, the Contractor shall submit payment requests by mail through the United States Postal Service to the designated agency office.

Submission of payment requests by mail may be required for—

(1) Awards made to foreign vendors for work performed outside the United States;

(2) Classified contracts or purchases when electronic submission and processing of payment requests could compromise the safeguarding of classified or privacy information;

(3) Contracts awarded by contracting officers in the conduct of emergency operations, such as responses to national emergencies;

(4) Solicitations or contracts in which the designated agency office is a VA entity other than the VA Financial Services Center in Austin, Texas; or

(5) Solicitations or contracts in which the VA designated agency office does not have electronic invoicing capability as described above.

(End of Clause)

C.9 VAAR 852.239-70 SECURITY REQUIREMENTS FOR INFORMATION

TECHNOLOGY RESOURCES (FEB 2023)

(a) Definitions. As used in this clause— Information technology has the same meaning in FAR

2.101 and also means Information and Communication Technology (ICT).

Information system security plan means a formal document that provides an overview of the security requirements for an information system and describes the security controls in place or planned for meeting those requirements.

(b) Responsibilities. The Contractor shall be responsible for information system security for all systems connected to a Department of Veterans Affairs (VA) network or operated by the Contractor for VA, regardless of location. This clause is applicable to all or any part of the contract that includes information technology resources or services in which the Contractor has physical or other system access to VA information that directly supports the mission of VA.

Examples of tasks that require security provisions include—

(1) Hosting of VA e-Government sites or other information technology operations;

(2) Acquisition, transmission, or analysis of data owned by VA with significant replacement cost should the contractor’s copy be corrupted; and

(3) Access to VA general support systems/ major applications at a level beyond that granted the general public, e.g., bypassing a firewall.

(c) Information system security plan. The Contractor shall develop, provide, implement, and maintain an Information System Security Plan. VA information systems must have an information system security plan that provides an overview of the security requirements for the system and describes the security controls in place or the plan for meeting those requirements.

This plan shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of information system resources developed, processed, or used under this contract. The information system security plan should include implementation status, responsible entities, resources, and estimated completion dates. Information system security plans may also include, but are not limited to, a compiled list of system characteristics, and key security-related documents such as a risk assessment, PIA, system interconnection agreements, contingency plan, security configurations, configuration management plan, and incident response plan. The plan shall address the specific contract requirements regarding information systems related support or services included in the contract, to include the performance work statement (PWS) or statement of work (SOW). The Contractor’s Information System Security Plan shall comply with applicable Federal Laws that include, but are not limited to, 40 U.S.C. 11331, the Federal Information Security Modernization Act (FISMA) of 2014 and the E-Government Act of 2002. The plan shall meet information system security requirements in accordance with Federal and VA policies and procedures, and as amended during the term of this contract, and include, but are not limited to the following.

(1) OMB Circular A–130, Managing Information as a Strategic Resource;

(2) National Institute of Standards and Technology (NIST) Guidelines; and

(3) VA Directive 6500, VA Cybersecurity Program, and the directives and handbooks in the VA 6500 series related to VA information (including VA sensitive information and sensitive personal information and information systems security and privacy), as well as those set forth in the contract specifications, statement of work, or performance work statement. These include, but are not limited to, VA Handbook 6500.6, Contract Security; and VA Directive and Handbook 0710, Personnel Security and Suitability Program, which establishes VA’s procedures, responsibilities, and processes for complying with current Federal law, Executive Orders, policies, regulations, standards and guidance for protecting VA information, information systems (see 802.101, Definitions) security and privacy, and adhering to personnel security requirements when accessing VA information or information systems.

(d) Submittal of plan. Within 90 days after contract award, the Contractor shall submit the Information System Security Plan to the Contracting Officer for review and approval.

(e) Security accreditation. As required by current VA policy, the Contractor shall submit written proof of information system security accreditation to the Contracting Officer for non-VA owned systems. Such written proof may be furnished either by the Contractor or by a third party.

Accreditation shall be in accordance with VA policy available from the Contracting Officer upon request. The Contractor shall submit for acceptance by the Contracting Officer along with this accreditation a final information system security plan, such as a risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. The accreditation and the final information system security plan and the accompanying documents, such as a risk assessment, security test and evaluation, and disaster recovery/continuity of operations plan.

(f) Annual validation. On an annual basis, the Contractor shall verify in writing to the Contracting Officer that the Information System Security Plan remains valid.

(g) Banners. The Contractor shall ensure that the official VA banners are displayed on all VA systems (both public and private) operated by the Contractor that contain Privacy Act information before allowing anyone access to the system. The Office of Information Technology will make official VA banners available to the Contractor.

(h) Screening and access. The Contractor shall screen all personnel requiring privileged access or limited privileged access to systems operated by the Contractor for VA or interconnected to a VA network in accordance with VA Directives and Handbooks referenced in paragraph (c) of this clause.

(i) Training. The Contractor shall ensure that its employees performing services under this contract complete VA security awareness training on an annual basis. This includes signing an acknowledgment that they have read, understand, and agree to abide by the VA Information Security Rules of Behavior (VA National Rules of Behavior) as required by 38 U.S.C. 5723; FAR 39.105, Privacy; clause 852.204–71, Information and Information Systems Security, and this clause on an annual basis.

(j) Government access. The Contractor shall provide the Government access to the Contractor’s and subcontractors’ facilities, installations, operations, documentation, databases, and personnel used in performance of the contract. The Contractor shall provide access to enable a program of information system inspection (to include vulnerability testing), investigation and audit (to safeguard against threats and hazards to the integrity, availability and confidentiality of VA data or to the function of information systems operated on behalf of VA), and to preserve evidence of computer crime.

(k) Notification of termination of employees. The Contractor shall immediately notify the Contracting Officer when an employee who has access to VA information systems or data terminates employment.

(l) Subcontractor flow down requirement. The Contractor shall incorporate and flow down the substance of this clause to all subcontracts that meet the conditions in paragraph (a) of this clause.

(End of Clause)

C.10 VAAR 852.239-73 INFORMATION SYSTEM HOSTING, OPERATION,

MAINTENANCE, OR USE (FEB 2023)

(a) Definitions. As used in this clause— Assessment and Authorization (A&A) means the process used to ensure information systems including Major Applications and General Support Systems have effective security safeguards which have been implemented, planned for, and documented in an Information Technology Security Plan. The A&A process per applicable VA policies and procedures is the mechanism by which VA provides an Authorization to Operate (ATO), the official management decision given by the VA to authorize operation of an information system (see VA Handbook 6500 for additional details). Information system security plan means a formal document that provides an overview of the security requirements for an information system and describes the security controls in place or planned for meeting those requirements.

(b) Hosting, operation, maintenance, or use at non-VA facilities. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, Contractors/subcontractors are fully responsible and accountable for ensuring compliance with the applicable Health Insurance Portability and Accountability (HIPAA) Act of 1996 (HIPAA) Privacy and Security Rules, the Privacy Act and other required VA confidentiality statutes included in VA’s mandatory yearly training and privacy handbooks, Federal Information Security Modernization Act (FISMA), National Institute of Standards and Technology (NIST), Federal Information Processing Standards (FIPS), and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The Contractor’s security control procedures must be equivalent to or exceed, those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the COR and approved by VA Privacy Service prior to approval to operate. All external internet connections to VA’s network involving VA information must be in accordance with the Trusted internet Connections (TIC) Reference Architecture and reviewed and approved by VA prior to implementation. For Cloud Services hosting, the Contractor shall also ensure compliance with the Federal Risk and Authorization Management Program (FedRAMP).

(c) Collecting, processing, transmitting, and storing of VA sensitive information. Adequate security controls for collecting, processing, transmitting, and storing of VA sensitive information, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the Information System Security Plan and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection, processing, transmitting, and storing of VA sensitive information.

(d) Annual FISMA security controls assessment. The Contractor/subcontractor’s system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the Privacy Impact Assessment. Any deficiencies noted during this assessment must be provided to the Contracting Officer for entry into VA’s POA&M management process. The Contractor/subcontractor must use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes specified by the VA in the performance work statement (PWS) or statement of work (SOW), or in the approved remediation plan through the VA POA&M process. Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with Contractor/ subcontractor activities must also be subject to such assessments. The results of an annual review or a major change in the cybersecurity posture at any time may indicate the need for reassessment and reauthorization of the system. If major changes to the system occur that may affect the privacy or security of the data or the system, the A&A of the system may need to be reviewed, retested and re1authorized per VA Handbook 6500. This may require reviewing and updating all of the documentation as described in VA Handbook 6500.6 (e.g., System Security Plan, Contingency Plan). See VA Handbook 6500.6 for a list of documentation. The VA Information System Risk Management (ISRM) office can provide guidance on whether a new A&A would be necessary.

(e) Annual self-assessment. The Contractor/subcontractor must conduct an annual self-assessment on all systems and outsourced services as required. Both hard copy and electronic copies of the assessment must be provided to the COR. VA reserves the right to conduct such an assessment using government personnel or another Contractor/subcontractor. The Contractor/ subcontractor must take appropriate and timely action, as may be specifically addressed in the contract, to correct or mitigate any weaknesses discovered during such testing, at no additional cost to the Government to correct Contractor/ subcontractor systems and outsourced services.

(f) Prohibition of installation and use of personally-owned or Contractor-owned equipment or software on VA networks. VA prohibits the installation and use of personally-owned or Contractor/ subcontractor-owned equipment or software on VA networks. If non-VA owned equipment must be used to fulfill the requirements of a contract, it must be stated in the service agreement, PWS, SOW or contract. All of the security controls required for government furnished equipment (GFE) must also be utilized in approved other equipment (OE) at the Contractor’s expense. All remote systems must be equipped with, and use, a VA-approved antivirus (AV) software and a personal (host-based or enclave based) firewall that is configured with a VA-approved configuration. Software must be kept current, including all critical updates and patches. Owners of approved OE are responsible for providing and maintaining the anti-viral software and the firewall on the non-VA owned OE.

(g) Disposal or return of electronic storage media on non-VA leased or non-VA owned IT equipment. All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with NIST 800–88, Rev. 1, ‘‘Guidelines for Media Sanitization,’’ and VA Directive 6500, VA Cybersecurity Program, paragraph 2(b)(5), Media Sanitization including upon—

(1) Completion or termination of the contract; or

(2) Disposal or return of the IT equipment by the Contractor/subcontractor or any person acting on behalf of the Contractor/ subcontractor, whichever is earlier. Media (e.g., hard drives, optical disks, CDs, back-up tapes) used by the Contractors/subcontractors that contain VA information must be returned to the VA for sanitization or destruction or the Contractor/subcontractor must self-certify that the media has been disposed of per VA Handbook 6500.1 requirements. This must be completed within 30 days of termination of the contract.

(h) Bio-Medical devices and other equipment or systems. Bio-Medical devices and other equipment or systems containing media (e.g., hard drives, optical disks) with VA sensitive information will not be returned to the Contractor at the end of lease, for trade-in, or other purposes. For purposes of these devices and protection of VA sensitive information the devices may be provided back to the Contractor under one of three scenarios—

(1) The Contractor must accept the system without the drive;

(2) A spare drive must be installed in place of the original drive at time of turn-in if VA’s initial medical device purchase included a spare drive; or

(3) The Contractor may request reimbursement for the drive at a reasonable open market replacement cost to be separately negotiated by the Contracting Officer and the Contractor at time of contract closeout.

(End of Clause)

C.11 VAAR 852.239-74 SECURITY CONTROLS COMPLIANCE TESTING

(FEB 2023)

On a…